0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
internallib_v524
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting internallib_v524, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-11512 | Unknown | Malicious code in internallib_v524 (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44) The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell.sh and pipe it into `sh`, connecting the installer's host back to 10.0.64.141:4433. Any consumer that requires the package and calls the exported API opens an interactive reverse shell to that hardcoded endpoint, giving the remote operator full RCE and persistent shell access on the installer's machine. The behavior is u |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44) The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell.sh and pipe it into `sh`, connecting the installer's host back to 10.0.64.141:4433. Any consumer that requires the package and calls the exported API opens an interactive reverse shell to that hardcoded endpoint, giving the remote operator full RCE and persistent shell access on the installer's machine. The behavior is u